1. Security of a Local Area NetworkBy
Nathan Wolverton

2. Security of a LAN
First step is to make the security policy in order to allocate resources
Once that is complete, you can decide how to set up the LAN
This is crucial because you have to know what area(s) needs to be secured the most

3. Ways to Block Unwanted Intrusions
Limit the number of computers that can connect at each port
Set the ports on the switch to a certain MAC address
If they still get in, disable insecure default configurations

4. Intrusion Detection Systems (IDS)
Alerts the administrator in real time of unwanted activity
IDS should be placed in front of public servers, behind firewalls to monitor traffic between internet and internal LAN, more sensitive subnets, outside of firewall to see what kind of attacks are being launched, and by a dial-up server or VPN concentrator

5. WLAN Security
WLAN should be protected by minimum of WEP. WPA is better
WPA uses a username and password that is specific to the individual
WEP uses SSID and a key to access the LAN
Change default SSID name and do not allow it to be broadcasted. It should be something that is misleading. i.e coffeeshop instead of banksecrets
RADIUS can be used to help secure the WEP shortcomings
Reduce the broadcast range so that it covers only the intended area

6. RADIUS
EAP-TLS(Extensible Authentication Protocol-Transport Layer Security)
PEAP(Protected Extensible Authentication Protocol)

7. RADIUS Cont. EAP-TLS PEAP Uses certificates to perform authentication
Server side certificates are used
Can enforce policies on users, specify the length of encryption key, and time interval for auto-renegotiation of the certificate
PEAP
Uses mutual certificates to perform authentication
This means that the client and server both must accept the authentication

8. Ways to Practice Good Security
Encourage or provide the use of virus software, spyware software, and firewalls for the home PC so your workers make good habits
Provide education to your employees in how to keep computers and information secure
Hire a third party to try to hack into the LAN to advise you on security vulnerabilities. This will tell you the area(s) that need to be fixed

9. Security Services
Identification and Authentication- helps to ensure that the LAN is accessed only by authorized individuals
Access Control- helps to ensure that LAN resources are being used in authorized manners
Data & Message Confidentiality- ensures that data, software, and messages are not disclosed to unauthorized parties

10. Security Services (cont.)
Data & Message Integrity- ensures that data, software, and messages are not modified by unauthorized parties
Non-repudiation- members involved in the communication cannot deny having participated. Specifically the sender cannot deny sending message and receiver cannot deny getting the message
Logging & Monitoring- uses of LAN resources can be traced throughout the LAN

11. Security Guidelines
Backup and Recovery - Backup of server files should happen on a nightly basis. Backup media should be stored in a safe environment, preferably off site. Users should be required to store important files on the server
Keep operating system’s and application software up to date
Dial up services should not be allowed. If necessary, should have host reboot upon disconnect

12. Security Guidelines (Cont.)
Physical Security should be limited to those that need to have access to the LAN server and related components
Should be an administrator for each LAN
Everything should be documented to ensure that security policies are being followed
Close unused network ports in order to prevent unauthorized use and block IP Addresses that are known to abuse the security policy

13. Security of a LAN Review Questions
What is the first step in securing a LAN?
Design the security policy
Should WEP or WPA be used to secure a WLAN?
WPA
What is one of two ways to fix the shortcomings of WEP?
EAP-TLS(Extensible Authentication Protocol-Transport Layer Security) and PEAP(Protected Extensible Authentication Protocol)
Where are some places Intrusion Detection Systems be placed?
In front of public servers, behind firewalls to monitor traffic between internet and internal LAN, more sensitive subnets, outside of firewall to see what kind of attacks are being launched, and by a dial-up server or VPN concentrator